Overview
overview
7Static
static
705a4836d3e...18.exe
windows7-x64
705a4836d3e...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...rb.dll
windows7-x64
3$PLUGINSDI...rb.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...la.rtf
windows7-x64
4$PLUGINSDI...la.rtf
windows10-2004-x64
1$PLUGINSDI...ay.dll
windows7-x64
7$PLUGINSDI...ay.dll
windows10-2004-x64
7$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ML.dll
windows7-x64
3$PLUGINSDI...ML.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows7-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$R1/$_1_/U...ll.exe
windows7-x64
7$R1/$_1_/U...ll.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 16:51
Behavioral task
behavioral1
Sample
05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InvokeShellVerb.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InvokeShellVerb.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/ask_eula.rtf
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/ask_eula.rtf
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsArray.dll
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsArray.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsisXML.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsisXML.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/registry.dll
Resource
win7-20240419-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
$R1/$_1_/Uninstall.exe
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
$R1/$_1_/Uninstall.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240419-en
General
-
Target
05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe
-
Size
1.6MB
-
MD5
05a4836d3e6e9c98040f457a1d6f78e9
-
SHA1
c5fd7fa1aa75140fd3f10f9e1ee79031a1d2ed4d
-
SHA256
201906c9f68f5ddb973bfb1d0bd499b3d0f8137a0d54e0c994b6d91d7ae391cd
-
SHA512
fca12e9e1f9030dc32a2bbd1e9333218f75558eef6200a04b204368aecb1581c7903232f1667721ac6069b00def7be25bfdab2cbc32a93e9c5ce3a59e122da0b
-
SSDEEP
24576:D6C4SAmwW9AFXPYMq/m+VO2kQEFAtURxnSHmxTX++6WF8uWH5YGydyg0Tm:14e9Ubi1cXQObnNRXXlWH5idyg0Tm
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exepid process 2040 05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe 2040 05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe 2040 05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe 2040 05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe 2040 05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe 2040 05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe 2040 05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main 05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe -
Modifies registry class 2 IoCs
Processes:
05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe 05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe\IsHostApp 05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2040 05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exepid process 2040 05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe 2040 05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsi1037.tmp\System.dllFilesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
\Users\Admin\AppData\Local\Temp\nsi1037.tmp\UAC.dllFilesize
13KB
MD5a88baad3461d2e9928a15753b1d93fd7
SHA1bb826e35264968bbc3b981d8430ac55df1e6d4a6
SHA256c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
SHA5125edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
-
\Users\Admin\AppData\Local\Temp\nsi1037.tmp\UserInfo.dllFilesize
4KB
MD5c7ce0e47c83525983fd2c4c9566b4aad
SHA138b7ad7bb32ffae35540fce373b8a671878dc54e
SHA2566293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
SHA512ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
-
\Users\Admin\AppData\Local\Temp\nsi1037.tmp\apphelp.dllFilesize
1.8MB
MD5bc8f81f42505bf9def590d7fe89da46c
SHA15f648334bd6d09c7388be43deb7461d4a47e36fe
SHA256a74e88300bc96ff413dd0b289a5023649592a7f2e68793d0a5ff71c6dc5f4130
SHA51291b08f39675f9456f05c9b2939eba3c778b0ce7f9558ecba6aea36832d526d01a9da4196e56023cf45b3d147834db7bcd9aef2997a103a497c9c527d13126b6c
-
\Users\Admin\AppData\Local\Temp\nsi1037.tmp\nsDialogs.dllFilesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
\Users\Admin\AppData\Local\Temp\nsi1037.tmp\registry.dllFilesize
24KB
MD52b7007ed0262ca02ef69d8990815cbeb
SHA12eabe4f755213666dbbbde024a5235ddde02b47f
SHA2560b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
SHA512aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
-
\Users\Admin\AppData\Local\Temp\nsi1037.tmp\soffer.dllFilesize
194KB
MD56a390c6bf2c5c8e8757d22007caf5afc
SHA1eef56517d48eaceaea2a18bc3f6fc024ad3dce1d
SHA2560d8fe8db08bd917851c3abf1fb61a4502647204e28efe2f34e7f49a7b19f7a6f
SHA5120a885683e6340d51a75a6f0909e13617e13fb2b6697331faa799fa156e1d8d20a67b94bb29651e3c51c9358c9dd9c9b01cd47bf58cb8be619dcc8c978bd0b63c
-
memory/2040-40-0x00000000024A0000-0x00000000024A1000-memory.dmpFilesize
4KB
-
memory/2040-53-0x00000000024A0000-0x00000000024A1000-memory.dmpFilesize
4KB